Threat actor · all actors

WIRTEG0090 unknown

aka WIRTE, Ashen Lepus

Last updated: 2026-07-03

0attributed CVEs

42ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	26 / 42	62%
`CM-6`	23 / 42	55%
`SI-3`	23 / 42	55%
`CM-2`	22 / 42	52%
`CA-7`	18 / 42	43%
`CM-7`	16 / 42	38%
`AC-4`	15 / 42	36%
`SI-7`	15 / 42	36%
`SC-7`	13 / 42	31%
`SI-10`	13 / 42	31%
`AC-3`	11 / 42	26%
`SI-2`	11 / 42	26%
`AC-6`	10 / 42	24%
`AC-2`	9 / 42	21%
`IA-9`	7 / 42	17%

Co-occurring actors

None.